Found a false positive goldmine in our SAST results last Tuesday

We ran a scan on the payment module and 40% of the findings were hitting the same hardcoded test key from 3 years ago. I wrote a quick regex to filter it out in the config, and now the triage queue is down by half. Has anyone else tried custom ignore rules for their scanner or do you just accept the noise?

1 comments

1 Comment

grace5081mo ago

...and honestly, the scanner gods giveth and the scanner gods taketh away. I spent a full afternoon once building a beautiful ignore list for our crypto module, only to find out it was also filtering out a real bug that our pen testers found three weeks later. Fun times. So yeah, I get the appeal of the quick regex fix, but I'd double check that thing isn't eating anything you actually need. Maybe keep the noisy test key in there but just mark it as known noise instead of vanishing it completely. Your future self might thank you when the auditors come knocking.